From b7986881e84d2e80e2a5a0e9f780e037b5ca1b08 Mon Sep 17 00:00:00 2001 From: Isabella Bastaja Date: Sat, 23 May 2026 22:29:33 +0200 Subject: set up wireguard --- hosts/nyaan/default.nix | 3 +- hosts/nyaan/network.nix | 111 ++++++++++++++++++++++++++++++++++++ hosts/nyaan/wireguard.nix | 62 -------------------- hosts/sagittarius/web/wireguard.nix | 4 +- secrets/wireless.env | 15 +++++ 5 files changed, 129 insertions(+), 66 deletions(-) create mode 100644 hosts/nyaan/network.nix delete mode 100644 hosts/nyaan/wireguard.nix create mode 100644 secrets/wireless.env diff --git a/hosts/nyaan/default.nix b/hosts/nyaan/default.nix index 5efb9a7..67de583 100644 --- a/hosts/nyaan/default.nix +++ b/hosts/nyaan/default.nix @@ -9,7 +9,7 @@ # Include the results of the hardware scan. ./hardware.nix - ./wireguard.nix + ./network.nix ./home.nix (flakeRoot + /share/system/client-common.nix) { @@ -29,7 +29,6 @@ boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.graceful = true; boot.loader.efi.canTouchEfiVariables = true; - networking.hostName = "nyaan"; time.timeZone = "Europe/Zagreb"; i18n.defaultLocale = "en_US.UTF-8"; diff --git a/hosts/nyaan/network.nix b/hosts/nyaan/network.nix new file mode 100644 index 0000000..ffacf65 --- /dev/null +++ b/hosts/nyaan/network.nix @@ -0,0 +1,111 @@ +{ config, ... }: +let + secrets = config.sops.secrets; + # NOTE: port is the same on every host + wgPort = 51820; +in +{ + sops = { + age.keyFile = "/var/lib/sops-nix/key.txt"; + secrets = { + "wg-priv-key" = { + sopsFile = ../../secrets/wg-nyaan-private.txt; + owner = "systemd-network"; + group = "systemd-network"; + mode = "0640"; + format = "binary"; + }; + "wireless.env" = { + sopsFile = ../../secrets/wireless.env; + owner = "wpa_supplicant"; + group = "wpa_supplicant"; + format = "dotenv"; + }; + }; + }; + + networking = { + hostName = "nyaan"; + firewall.allowedUDPPorts = [ wgPort ]; + useNetworkd = true; + wireless = { + enable = true; + secretsFile = secrets."wireless.env".path; + userControlled = true; + networks = { + "KopsiNet-5".pskRaw = "ext:kopsinet_psk"; + "Pixel_3139" = { + pskRaw = "ext:phone_hotspot_psk"; + hidden = true; + }; + "eduroam" = { + authProtocols = [ "WPA-EAP" ]; + auth = '' + pairwise=CCMP TKIP + eap=TTLS PEAP TLS + group=CCMP TKIP + identity="mbastaja@tvz.hr" + altsubject_match="DNS:freeradius.tvz.hr" + phase1="peaplabel=0" + phase2="auth=PAP" + password="ext:eduroam_pass" + anonymous_identity="anonymous@tvz.hr" + ''; + }; + "Students-TVZ" = { + authProtocols = [ "WPA-EAP" ]; + auth = '' + pairwise=CCMP TKIP + eap=PEAP + group=CCMP TKIP + identity="mbastaja@tvz.hr" + phase1="peaplabel=0" + phase2="auth=MSCHAPV2" + password="ext:eduroam_pass" + ''; + }; + }; + }; + }; + + systemd.network = { + enable = true; + networks."50-wg" = { + matchConfig.Name = "wg0"; + address = [ + "2301:db8:acad:a::2/128" + "192.168.23.2/32" + ]; + }; + netdevs."50-wg" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg0"; + }; + + wireguardConfig = { + ListenPort = wgPort; + PrivateKeyFile = config.sops.secrets."wg-priv-key".path; + # To automatically create routes for everything in AllowedIPs, + # add RouteTable=main + RouteTable = "main"; + # FirewallMark marks all packets send and received by wg0 with the + # number 42, which can be used to define policy rules on these packets. + FirewallMark = 42; + }; + + wireguardPeers = [ + { + # sagittarius + PublicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI="; + AllowedIPs = [ + "2301:db8:acad:a::1/128" + "192.168.23.1/32" + ]; + Endpoint = "95.216.136.85:${toString wgPort}"; + PersistentKeepalive = 1; + } + ]; + }; + }; +} diff --git a/hosts/nyaan/wireguard.nix b/hosts/nyaan/wireguard.nix deleted file mode 100644 index c8e562d..0000000 --- a/hosts/nyaan/wireguard.nix +++ /dev/null @@ -1,62 +0,0 @@ -{ config, ... }: -let - # NOTE: port is the same on every host - port = 51820; -in -{ - sops = { - age.keyFile = "/var/lib/sops-nix/key.txt"; - secrets = { - "wg-priv-key" = { - sopsFile = ../../secrets/wg-nyaan-private.txt; - owner = "systemd-network"; - group = "systemd-network"; - mode = "0640"; - format = "binary"; - }; - }; - }; - - networking.firewall.allowedUDPPorts = [ port ]; - networking.useNetworkd = true; - - systemd.network = { - enable = true; - networks."50-wg" = { - matchConfig.Name = "wg0"; - address = [ - "2301:db8:acad:a::2/128" - "192.168.5.2/32" - ]; - }; - netdevs."50-wg" = { - netdevConfig = { - Kind = "wireguard"; - Name = "wg0"; - }; - - wireguardConfig = { - ListenPort = port; - PrivateKeyFile = config.sops.secrets."wg-priv-key".path; - # To automatically create routes for everything in AllowedIPs, - # add RouteTable=main - RouteTable = "main"; - # FirewallMark marks all packets send and received by wg0 with the - # number 42, which can be used to define policy rules on these packets. - FirewallMark = 42; - }; - - wireguardPeers = [ - { - # sagittarius - PublicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0="; - AllowedIPs = [ - "2301:db8:acad:a::1/128" - "192.168.5.1/32" - ]; - Endpoint = "95.216.136.85:${toString port}"; - } - ]; - }; - }; -} diff --git a/hosts/sagittarius/web/wireguard.nix b/hosts/sagittarius/web/wireguard.nix index 7760174..a3eefc6 100644 --- a/hosts/sagittarius/web/wireguard.nix +++ b/hosts/sagittarius/web/wireguard.nix @@ -13,7 +13,7 @@ in matchConfig.Name = "wg0"; address = [ "2301:db8:acad:a::1/128" - "192.168.5.1/32" + "192.168.23.1/32" ]; }; netdevs."50-wg" = { @@ -39,7 +39,7 @@ in PublicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0="; AllowedIPs = [ "2301:db8:acad:a::2/128" - "192.168.5.2/32" + "192.168.23.2/32" ]; } ]; diff --git a/secrets/wireless.env b/secrets/wireless.env new file mode 100644 index 0000000..e5fdb06 --- /dev/null +++ b/secrets/wireless.env @@ -0,0 +1,15 @@ +kopsinet_psk=ENC[AES256_GCM,data:f/iEwzRmGDs2,iv:xeMGBa1/IqbCQXfTeJy+3SM3kYmEn3rXPOjcbFoeAQw=,tag:VtmskqeCq2FK1BYCZw7KhA==,type:str] +phone_hotspot_psk=ENC[AES256_GCM,data:5ObnVP5gJnYZ3wf992Z6,iv:jYI20suGpLb6SW3+YA5hW6ericlVBBgobk78Hwq6Gfc=,tag:A30jiTrvFYqbDvCBsXqdsw==,type:str] +eduroam_pass=ENC[AES256_GCM,data:w2SckV1rLNM=,iv:TWkHKh2t20kdhjNpPMFfJ+bsDU53QxxtW0nWCltTzvo=,tag:jFMyrwVbJvLLHCfdmRzX+Q==,type:str] +sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2WHpJUEtJdHFiVEdiMlNz\nZmYwdGtxZmRJZlpab1dVNEw2ZldvVHhaMlNnCkJnYmkxSEJLY1JBZFNPcVpGNyt4\nbjJ3dVFhcjdhWkVJVHNaWWorRldZK0kKLS0tIEVTMlo2Qjg2M29PMEtrMEZGRGkx\ncmdxMWtjT09DQktQaVFQZXF3Wm5KbXcKtDK2i2AtzqOXPbiO1EW4e+ZzgKYD9SsE\nq4AKu2VQZaTw3Ex+66k7geso9A7LCp2T++/z2FgfGxpUYJW9nhnesQ==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_0__map_recipient=age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk +sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMUDhGVmUxbUJEaXgwcnQr\nNkRQTW1jSW4yWHU2MFBMelhNTnhLSG5TNjNnCkhlWHAxSThhOGN2RFEyWVcvYlN4\nbWlHdEhoTWNGNEVWQ0xGYytoWEI5QzQKLS0tIE5oVDBESndYQkFQTW5qMW1tQ2pv\nbElLRFVvSVozaXp0K1ZpR2x5UnZFR3cK92cYZrUzqtBH8JiS0u+MiCbcxtfSaYqQ\nZUCKHv5TX0Ck5mj+P+jHIUQtP+tM55DFO01C3OaaMl7LqGJD10g5Xw==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_1__map_recipient=age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc +sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2bEg2NHVFamphaWc0RTd4\nVkFDeVdJS2Z1RlRldmZnUXlRK3U0TlhsaUZvCkZ4R3F4dnUwWFRPa0FQU1VzOXNE\nUHl6S3RUZ3NMUDdUT0FjOVM1cnIxcEUKLS0tIEZxVi9VMzNCcDJ0V3dZcjd2SXNU\nODc2NjgvSWZZS0tVc2JhUFhJVUxESDQKnQelM+2bqt4A8ZeSopTTlb2evJcv2Z2b\nhw6bM4EniHCdDDXE0CHeS9gRE7dvBXScH1wWBwV3+NuoxNfFZJmLBA==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_2__map_recipient=age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern +sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvNGZuWjVtbUpYS1RIbVNN\nSUdNb3lFYXBSZW5zRklQeTVqTTFxcUFVQkY4ClNZQlVKaGxiTUk5OFA1RnprVGtN\nUjhEY3A4UGdZcjdsekh0Q29BVnhBZmMKLS0tIDFzY1MyTUV2dThUS3RpOU41WXVl\nMTg1OXNLSk53c2F6NEU2a0crYlltSzAK+Ur555UsinV368DYgSeJvyU+ZZ0Qi3+w\n1zAi3buJ+P+wbf/j1Tuit1YkJdp3N4w5MilDdxc0laD+7/PSReAYZQ==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_3__map_recipient=age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6 +sops_lastmodified=2026-05-23T20:48:56Z +sops_mac=ENC[AES256_GCM,data:eZIlr8kRPC/HOWRrXc2o1uv8WrZkUZV2eVOioAjPecXukxLKajMTHsRIaNICce579RIeMAZwBk2lpXcYru+J4xxAR86oBvloy6BVhbz7oAKzHIzaLZSBjkdFyKv80o21yas64w6M5p1lyJTpmmaoYxjDeFLKd8SgTwi3un/HuIg=,iv:jCNCgWHeoXsw68X/aQWAGeaAsS2gnHhmFP0XMsdq0Z0=,tag:9PHtYfdKGINEdM3o8Togfw==,type:str] +sops_unencrypted_suffix=_unencrypted +sops_version=3.13.1 -- cgit v1.3.1